platform_system_sepolicy/private/keystore.te

typeattribute keystore coredomain;

init_daemon_domain(keystore)

# talk to keymaster
hal_client_domain(keystore, hal_keymaster)

# talk to confirmationui
hal_client_domain(keystore, hal_confirmationui)

# This is used for the ConfirmationUI async callback.
allow keystore platform_app:binder call;

# Allow to check whether security logging is enabled.
get_prop(keystore, device_logging_prop)

# Allow keystore to write to statsd.
unix_socket_send(keystore, statsdw, statsd)

# Keystore need access to the keystore_key context files to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;