From 9730877236ab5d330f83dd8b4554c64e1620b2f4 Mon Sep 17 00:00:00 2001
From: Edwin Wong <edwinwong@google.com>
Date: Mon, 11 Jul 2022 23:03:34 +0000
Subject: [PATCH] Enable dumpsys widevine without root

Before the addition of sepolicy:
Error with service 'android.hardware.drm.IDrmFactory/widevine' while dumping: FAILED_TRANSACTION

Success after change.

Test: adb shell dumpsys android.hardware.drm.IDrmFactory/widevine

Bug: 238682056
Change-Id: I3817c9487bdec0c812690823cbb941cff80f394f
---
 public/hal_drm.te | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/public/hal_drm.te b/public/hal_drm.te
index 72fa308c1..43d0a7cba 100644
--- a/public/hal_drm.te
+++ b/public/hal_drm.te
@@ -26,6 +26,12 @@ r_dir_file(hal_drm, cgroup_v2)
 allow hal_drm cgroup_v2:dir { search write };
 allow hal_drm cgroup_v2:file w_file_perms;
 
+# Allow dumpsys Widevine without root
+userdebug_or_eng(`
+  allow hal_drm_server shell:fd use;
+  allow hal_drm_server shell:fifo_file write;
+')
+
 # Allow access to ion memory allocation device
 allow hal_drm ion_device:chr_file rw_file_perms;
 allow hal_drm hal_graphics_allocator:fd use;