platform_system_sepolicy/private/keystore.te

typeattribute keystore coredomain;

init_daemon_domain(keystore)

# talk to keymaster
hal_client_domain(keystore, hal_keymaster)

# talk to confirmationui
hal_client_domain(keystore, hal_confirmationui)

# talk to keymint
hal_client_domain(keystore, hal_keymint)

# Ignore keystore attempts to access the AVF RKP Hal but keystore is not suppose to
# access it.
# TODO(b/312427637): Investigate the reason and fix the denial.
dontaudit keystore hal_remotelyprovisionedcomponent_avf_service:service_manager { find };

# This is used for the ConfirmationUI async callback.
allow keystore platform_app:binder call;

# Allow to check whether security logging is enabled.
get_prop(keystore, device_logging_prop)

# Allow keystore to check if the system is rkp only.
get_prop(keystore, remote_prov_prop)

# Allow keystore to check rkpd feature flags
get_prop(keystore, device_config_remote_key_provisioning_native_prop)

# Allow keystore to write to statsd.
unix_socket_send(keystore, statsdw, statsd)

# Keystore need access to the keystore2_key_contexts file to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;

# Allow keystore to listen to changing boot levels
get_prop(keystore, keystore_listen_prop)

# Keystore needs to transfer binder references to vold so that it
# can call keystore methods on those references.
allow keystore vold:binder transfer;

# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
# system property, an exception is added for init as well.
set_prop(keystore, keystore_crash_prop)
neverallow { domain -keystore -init } keystore_crash_prop:property_service set;

# keystore is using apex_info via libvintf
use_apex_info(keystore)