| ### |
| ### A domain for further sandboxing the GooglePermissionController app. |
| ### |
| type permissioncontroller_app, domain, coredomain; |
| |
| app_domain(permissioncontroller_app) |
| |
| allow permissioncontroller_app app_api_service:service_manager find; |
| allow permissioncontroller_app system_api_service:service_manager find; |
| |
| # Allow interaction with gpuservice |
| binder_call(permissioncontroller_app, gpuservice) |
| |
| allow permissioncontroller_app radio_service:service_manager find; |
| |
| # Allow the app to request and collect incident reports. |
| # (Also requires DUMP and PACKAGE_USAGE_STATS permissions) |
| allow permissioncontroller_app incident_service:service_manager find; |
| binder_call(permissioncontroller_app, incidentd) |
| allow permissioncontroller_app incidentd:fifo_file { read write }; |
| |
| allow permissioncontroller_app gpu_device:dir search; |
