Preliminary policy for hal_keymaster (TREBLE)
This adds the premissions required for
android.hardware.keymaster@2.0-service to access the keymaster TA
as well as for keystore and vold to lookup and use
android.hardware.keymaster@2.0-service.
IT DOES NOT remove the privileges from keystore and vold to access
the keymaster TA directly.
Test: Run keystore CTS tests
Bug: 32020919
(cherry picked from commit 5090d6f3241ffbd96f5a0b24df602bd2559f3cf4)
Change-Id: Ib02682da26e2dbcabd81bc23169f9bd0e832eb19
diff --git a/public/hal_keymaster.te b/public/hal_keymaster.te
new file mode 100644
index 0000000..a3aef59
--- /dev/null
+++ b/public/hal_keymaster.te
@@ -0,0 +1,7 @@
+# hwbinder access
+hwbinder_use(hal_keymaster)
+
+allow hal_keymaster tee_device:chr_file rw_file_perms;
+allow hal_keymaster tee:unix_stream_socket connectto;
+
+allow hal_keymaster ion_device:chr_file r_file_perms;