platform_system_sepolicy/private/hal_codec2.te

get_prop(hal_codec2_client, media_variant_prop)
get_prop(hal_codec2_server, media_variant_prop)
get_prop(hal_codec2_client, codec2_config_prop)
get_prop(hal_codec2_server, codec2_config_prop)

binder_call(hal_codec2_client, hal_codec2_server)
binder_call(hal_codec2_server, hal_codec2_client)

hal_attribute_hwservice(hal_codec2, hal_codec2_hwservice)
hal_attribute_service(hal_codec2, hal_codec2_service)

# The following permissions are added to hal_codec2_server because vendor and
# vndk libraries provided for Codec2 implementation need them.

# Allow server access to composer sync fences
allow hal_codec2_server hal_graphics_composer:fd use;

# Allow both server and client access to ion
allow hal_codec2_server ion_device:chr_file r_file_perms;

# Allow server access to camera HAL's fences
allow hal_codec2_server hal_camera:fd use;

# Receive gralloc buffer FDs from bufferhubd.
allow hal_codec2_server bufferhubd:fd use;

allow hal_codec2_client ion_device:chr_file r_file_perms;

# codec2 aidl graphic buffer allocation waitable object
allow hal_codec2_server su:fifo_file read;
allow hal_codec2_server mediaserver:fifo_file read;
allow hal_codec2_server { appdomain -isolated_app_all }:fifo_file read;