platform_system_sepolicy/public/hal_identity.te

# HwBinder IPC from client to server
binder_call(hal_identity_client, hal_identity_server)

hal_attribute_service(hal_identity, hal_identity_service)

binder_call(hal_identity_server, servicemanager)
Add SELinux policy for Identity Credential HAL Bug: 111446262 Test: VtsHalIdentityCredentialTargetTest Change-Id: Icb5a0d8b24d463a2f1533f8dd3bfa84bf90acc6f 2020-01-15 01:44:40 +01:00			`# HwBinder IPC from client to server`
			`binder_call(hal_identity_client, hal_identity_server)`

Make AIDL HAL client attribute an exclusive client. Like HIDL HALs, if we have a service which is allowed to access hal_<foo>_service, we want that service to have the attribute hal_<foo>_client. Unlike HIDL HALs, some AIDL services are allowed to get ahold of all HALs, so these have to be exempted from this check. Fixes: 168152053 Test: neverallows pass Change-Id: I4bce6d9441c2921c3ea40f2b01fef4030c02a28a 2020-09-11 00:57:51 +02:00			`hal_attribute_service(hal_identity, hal_identity_service)`
Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. The credstore service is a system service which backs the android.security.identity.* Framework APIs. It essentially calls into the Identity Credential HAL while providing persistent storage for credentials. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60 2020-01-17 22:47:53 +01:00
Make AIDL HAL client attribute an exclusive client. Like HIDL HALs, if we have a service which is allowed to access hal_<foo>_service, we want that service to have the attribute hal_<foo>_client. Unlike HIDL HALs, some AIDL services are allowed to get ahold of all HALs, so these have to be exempted from this check. Fixes: 168152053 Test: neverallows pass Change-Id: I4bce6d9441c2921c3ea40f2b01fef4030c02a28a 2020-09-11 00:57:51 +02:00			`binder_call(hal_identity_server, servicemanager)`