Merge "Move hals to vendor partition."
diff --git a/private/app.te b/private/app.te
index e0fb6f1..b009d98 100644
--- a/private/app.te
+++ b/private/app.te
@@ -158,6 +158,11 @@
# Perform binder IPC to ephemeral apps.
binder_call(appdomain, ephemeral_app)
+# hidl access for mediacodec
+# TODO(b/34454312): only allow getting and talking to mediacodec service
+hwbinder_use(appdomain)
+hwallocator_use(appdomain)
+
# Already connected, unnamed sockets being passed over some other IPC
# hence no sock_file or connectto permission. This appears to be how
# Chrome works, may need to be updated as more apps using isolated services
diff --git a/private/init.te b/private/init.te
index d495d54..8a6dcea 100644
--- a/private/init.te
+++ b/private/init.te
@@ -17,3 +17,8 @@
userdebug_or_eng(`
domain_auto_trans(init, logcat_exec, logpersist)
')
+
+# Creating files on sysfs is impossible so this isn't a threat
+# Sometimes we have to write to non-existent files to avoid conditional
+# init behavior. See b/35303861 for an example.
+dontaudit init sysfs:dir write;
diff --git a/private/system_server.te b/private/system_server.te
index 30fe3e2..cba1ab3 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -179,6 +179,7 @@
# Perform HwBinder IPC.
hwbinder_use(system_server)
+hwallocator_use(system_server)
binder_call(system_server, hal_bluetooth)
binder_call(system_server, hal_boot)
binder_call(system_server, hal_contexthub)
diff --git a/public/hal_graphics_composer.te b/public/hal_graphics_composer.te
index ee12ff1..9ba0bdb 100644
--- a/public/hal_graphics_composer.te
+++ b/public/hal_graphics_composer.te
@@ -14,3 +14,6 @@
allow hal_graphics_composer system_server:fd use;
allow hal_graphics_composer bootanim:fd use;
allow hal_graphics_composer appdomain:fd use;
+
+# allow self to set SCHED_FIFO
+allow hal_graphics_composer self:capability sys_nice;
diff --git a/public/mediacodec.te b/public/mediacodec.te
index 9f07d85..6b4d677 100644
--- a/public/mediacodec.te
+++ b/public/mediacodec.te
@@ -18,6 +18,11 @@
allow mediacodec ion_device:chr_file rw_file_perms;
allow mediacodec hal_graphics_allocator:fd use;
+# hidl access
+hwbinder_use(mediacodec)
+hwallocator_use(mediacodec)
+allow mediacodec system_file:dir { open read };
+
###
### neverallow rules
###
diff --git a/public/mediaserver.te b/public/mediaserver.te
index 16b8013..fa47288 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -132,6 +132,10 @@
allow mediaserver system_server:fd use;
+# hidl access
+hwbinder_use(mediaserver)
+hwallocator_use(mediaserver)
+
###
### neverallow rules
###