| # Set a new domain |
| type mtk_hal_keymanage, domain; |
| |
| # Set mtk_hal_keymanage as server domain of hal_keymaster |
| hal_server_domain(mtk_hal_keymanage, hal_keymaster) |
| |
| # Set exec file type |
| type mtk_hal_keymanage_exec, exec_type, file_type, vendor_file_type; |
| |
| # Setup for domain transition |
| init_daemon_domain(mtk_hal_keymanage) |
| |
| # Associate mtk_hal_keymanage_hwservice with all server domain |
| add_hwservice(hal_keymaster_server, mtk_hal_keymanage_hwservice) |
| |
| # Give permission for hal_keymaster_client to find mtk_hal_keymanage_hwservice via hwservice_manager |
| allow hal_keymaster_client mtk_hal_keymanage_hwservice:hwservice_manager find; |
| |
| # Give permission for hal_key_manage to access kisd service |
| |
| allow mtk_hal_keymanage kisd:unix_stream_socket connectto; |
| |
| # Allow mtk_hal_keyinstall to access /data/key_provisioning |
| allow mtk_hal_keymanage key_install_data_file:dir { write add_name remove_name search }; |
| allow mtk_hal_keymanage key_install_data_file:file { write create setattr read getattr unlink open append }; |
| |
| allow mtk_hal_keymanage debugfs_tracing:file { write }; |