From 2eca9e4a44377b7b32620e44075743ea4d7a4b8f Mon Sep 17 00:00:00 2001
From: Yin-Chia Yeh <yinchiayeh@google.com>
Date: Tue, 21 Feb 2017 13:07:00 -0800
Subject: [PATCH] Camera: allow appdomain FD use for hal_camera

The preview surface will run in app process and hal_camera will
need to wait on FD generated by preview surface.

Test: the denial is gone, able to take photo in
      messenger/hangout/drive application.
Bug: 35589980
Bug: 35485227
Change-Id: I1977174369b104617156065ff25203a17265b707
---
 public/hal_camera.te | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/public/hal_camera.te b/public/hal_camera.te
index 02b8e77b6..d9386fddf 100644
--- a/public/hal_camera.te
+++ b/public/hal_camera.te
@@ -13,6 +13,8 @@ allow hal_camera ion_device:chr_file rw_file_perms;
 # Both the client and the server need to use the graphics allocator
 allow { hal_camera_client hal_camera_server } hal_graphics_allocator:fd use;
 
+# Allow hal_camera to use fence FD from surface owned by application
+allow hal_camera appdomain:fd use;
 
 ###
 ### neverallow rules