blob: e2a50067d17d14e62cc6f2eb0281a77c28650974 [file] [log] [blame]
# trunksd.
type trunksd, domain;
type trunksd_exec, exec_type, file_type;
type trunksd_data_file, file_type, data_file_type;
# Allow crash_reporter access to core dump files.
# Allow Minijail to drop privilege.
allow trunksd self:capability { setuid setgid };
# Allow adding the binder service.
allow trunksd trunks_service:service_manager { add find };
# Allow the TPM simulator to manage persistent data.
allow trunksd trunksd_data_file:dir rw_dir_perms;
allow trunksd trunksd_data_file:file create_file_perms;
# TODO(dkrahn): Investigate why these are needed.
allow trunksd proc:file r_file_perms;
allow trunksd self:capability dac_override;
# Allow access to TPM device.
allow trunksd tpm_device:chr_file rw_file_perms;