non_plat/nvram_agent_binder.te

# ==============================================
# Policy File of /vendor/bin/nvram_agent_binder Executable File

# ==============================================
# Type Declaration
# ==============================================
type nvram_agent_binder_exec , exec_type, file_type, vendor_file_type;
type nvram_agent_binder ,domain;

# ==============================================
# MTK Policy Rule
# ==============================================
init_daemon_domain(nvram_agent_binder)

# Date : WK14.35
# Operation : access nvram by binder 
# Purpose : ensure nvram user can access nvram file normally. 
#allow nvram_agent_binder nvram_agent_service:service_manager add;

# Date : WK14.43
# Operation : 2rd Selinux Migration 
# Purpose : the role of nvram_agent_binder is same with nvram_daemon except property_set & exect permission
allow nvram_agent_binder nvram_device:blk_file rw_file_perms;
allow nvram_agent_binder nvdata_device:blk_file rw_file_perms;
allow nvram_agent_binder nvram_data_file:dir create_dir_perms;
allow nvram_agent_binder nvram_data_file:file create_file_perms;
allow nvram_agent_binder nvram_data_file:lnk_file read;
allow nvram_agent_binder nvdata_file:lnk_file read;
allow nvram_agent_binder nvdata_file:dir create_dir_perms;
allow nvram_agent_binder nvdata_file:file create_file_perms;

allow nvram_agent_binder als_ps_device:chr_file r_file_perms;
allow nvram_agent_binder mtk-adc-cali_device:chr_file rw_file_perms;
allow nvram_agent_binder gsensor_device:chr_file r_file_perms;
allow nvram_agent_binder gyroscope_device:chr_file r_file_perms;
allow nvram_agent_binder self:capability { fowner chown fsetid };

# Purpose: for backup
allow nvram_agent_binder nvram_device:chr_file rw_file_perms;
allow nvram_agent_binder pro_info_device:chr_file rw_file_perms;
allow nvram_agent_binder block_device:dir search;

# for MLC device
allow nvram_agent_binder mtd_device:dir search;
allow nvram_agent_binder mtd_device:chr_file rw_file_perms;

#for nvram agent hidl
get_prop(nvram_agent_binder, hwservicemanager_prop)

# Allow to use HWBinder IPC
hwbinder_use(nvram_agent_binder);

# Allow a set of permissions required for a domain to be a server which provides a HAL implementation over HWBinder.
hal_server_domain(nvram_agent_binder, hal_nvramagent)

# Date : WK18.16
# Operation: P migration
# Purpose: Allow nvram_daemon to get vendor_mtk_tel_switch_prop
get_prop(nvram_daemon, vendor_mtk_tel_switch_prop)

# Date : WK18.21
# Operation: P migration
# Purpose: Allow to search /mnt/vendor/nvdata when using nvram function
allow nvram_agent_binder mnt_vendor_file:dir search;

allow nvram_agent_binder sysfs_boot_mode:file r_file_perms;